22OCT

Sírio-Libanês says patient data at risk

2 min read

16:31UTC

São Paulo's Hospital Sírio-Libanês disclosed on 16 October that a September attack reached a reporting system tied to its social projects, possibly exposing patients' and staff's health and identity data.

← Back to Fridge hack spoils food in seven countries Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Hospital Sírio-Libanês says a side system, not its patient database, exposed health and identity data.

São Paulo's Hospital Sírio-Libanês disclosed on 16 October that a 21 September attack reached an internal reporting system tied to its social projects⁠¹. It may have exposed names, identity card and taxpayer numbers, addresses and health information of patients and staff. The general patient database was not affected, and care continued.

The hospital notified Brazil's data-protection authority, the Autoridade Nacional de Proteção de Dados (ANPD), and Brazil's Polícia Federal. It also appears on a criminal leak site; the hospital has not named an attacker⁠². In the US, Astrana Health told regulators in September that its own incident was material because of the patient, employee and provider data involved.

Deep Analysis

In plain English

Hospital Sírio-Libanês is a large private hospital in São Paulo, Brazil. It says hackers got into one of its internal systems on 21 September, a system linked to its charity and social programmes. That system held names, ID and tax numbers, addresses and health details of some patients and staff. The main patient records were not affected and treatment carried on. The hospital told Brazil's data-protection authority and the federal police.

Deep Analysis

Root Causes

Hospitals run many side systems beyond the clinical record: research, philanthropy, social programmes and reporting tools. These often hold copies of patient identity and health data under weaker controls than the core record.

The gap between the 21 September attack and the 16 October disclosure likely reflects the forensic work needed to establish which records the intruder reached.

What could happen next?

Risk
Identity and taxpayer numbers exposed alongside health data give fraudsters what they need for impersonation and targeted scams.
Consequence
Brazil's data-protection authority may review the incident, given that health data is involved.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: Astrana Health's September filing also called a breach serious because of the patient and staff data involved, while expecting no hit to operations. Sírio-Libanês likewise kept care running while health and identity data left a side system.

Counter-parallel: River Financial filed repeatedly without being able to say whether personal data was affected. Sírio-Libanês named the system and the data types within four weeks, a faster account of scope.

Consensus view: The hospital confines the breach to an internal reporting system tied to its social projects and says the general patient database was untouched. It notified the Autoridade Nacional de Proteção de Dados and the Polícia Federal, the route Brazil's data-protection law sets for incidents that may harm the people in the data.

Counter-view: The hospital also appears on a criminal leak site. Leak sites exist to pressure payment, so the claimant may hold, or say it holds, more than the hospital has confirmed, and the hospital has not named an attacker.

Key tension: Whether the leak-site posting reflects data from the social-projects system alone, or from systems the hospital has not yet tied to the attack.

Sources:ransomware.live·SBT News

Mentions:Brazil →Astrana Health →Hospital Sírio-Libanês →Autoridade Nacional de Proteção de Dados →Polícia Federal →São Paulo →

First Reported In

Update #15 · Fridge hack spoils food in seven countries

ransomware.live· 22 Oct 2026

Read original →

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.